MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: email security

  • Give Everyone a “This Looks Wrong” Button

    Give Everyone a “This Looks Wrong” Button

    The nursery coordinator gets an email on a Sunday evening.

    Your mailbox has exceeded its storage limit. 3 messages are being held for delivery. Sign in within 24 hours to release them, or they will be deleted.

    Something about it feels off. The wording is slightly stiff. She’s never had a quota problem before. She looks at it for a few seconds, decides it’s probably nothing, and deletes it.

    That’s the end of it, as far as anyone in the church ever knows.

    What she doesn’t know is that the same message went to eleven other people that evening, and that one of them — the volunteer bookkeeper, checking email between services — clicked it and typed in her password.

    Nobody in this story behaved badly. The coordinator’s instinct was excellent. She just had nowhere to put it. There was no address to send it to, no button to press, and a small, entirely reasonable fear of being the person who bothered the pastor about an email that turned out to be fine.

    The gap between someone noticed and anyone acted is where most of these attacks live. Closing that gap is one of the highest-value things a small organization can do, and it costs nothing.

    Your people are already the detection system

    Small churches and nonprofits do not have a security team watching the mail flow. What they have is eight or twelve people who know how things normally sound around here.

    That knowledge is genuinely good. The office administrator knows the pastor doesn’t send one-line emails asking for a favor while he’s “in a meeting.” The treasurer knows the roofing contractor has never changed bank details mid-project.

    Filters catch a great deal, and you should certainly have them turned on. But phishing is designed to survive filters — a well-crafted message from a newly registered domain, with no attachment and no malicious link on any list yet, sails through into the inbox looking ordinary. The last line of detection is a human being noticing that something feels wrong.

    Right now, in most small organizations, that noticing produces nothing at all. Not because people don’t care — because there’s nowhere for it to go.

    The mechanics: build somewhere to send it

    This is the easy half, and it takes about twenty minutes.

    Option one: an address everyone knows. Create a shared mailbox or a group address — security@, checkthis@, isthisreal@, whatever your people will actually remember. Point it at two or three people: whoever handles IT things, the office administrator, and one other person so it’s never one person’s holiday that stalls it. Both Microsoft 365 and Google Workspace let you create a shared mailbox or group at no extra cost.

    The name matters more than it should. Security sounds formal, and formality makes people hesitate. Checkthis@ sounds like asking a colleague, which is exactly the behavior you want.

    Option two: the button that’s already there. Microsoft 365 and Google Workspace both include a report function in the mail app itself.

    In Microsoft 365, there’s a built-in Report button in Outlook that lets people flag a message as phishing or junk. An administrator can configure where those reports go — to Microsoft for analysis, to a mailbox you nominate inside the organization, or to both. Choosing “both” is the right answer for most churches: Microsoft’s systems learn from it, and a person in your building sees it too.

    In Gmail, opening a message and choosing the report-phishing option under the message’s more menu sends a copy to Google and moves the message out of the inbox.

    Use both. The button is one click and gets used; the address is where the awkward cases go — a text message someone got, a phone call, a letter, a QR code on a poster in the lobby. The button only handles email. Real life doesn’t.

    Say the same thing on every path. Put the address in the email signature block for staff, on the sheet taped by the office phone, and on the volunteer welcome page. The failure mode isn’t people refusing to report. It’s people not remembering how.

    Forward it the right way. One small technical detail makes a real difference to whoever reviews the report. When you forward an email normally, the mail app makes a new message and pastes the old text inside it. What gets lost is the hidden header information — the record of which servers actually handled the message and where it really came from. That’s often the fastest way to tell a genuine message from a convincing forgery, and an ordinary forward destroys it.

    Forwarding as an attachment preserves the original message intact, headers and all. Both Gmail and Outlook can do it; in Gmail it’s an option in the message’s menu, and in Outlook you can drag a message into a new one or choose the attachment-forwarding option. The built-in report buttons do this automatically, which is another argument for using them.

    Two rules to say out loud alongside it: don’t click anything in the message before you report it, and don’t delete it after — leave it in a folder for a week in case someone needs to look.

    The half that actually decides whether this works

    Here’s the uncomfortable part. The technical setup is twenty minutes. Whether anyone uses it depends entirely on how the first few reports are received.

    People do not report because they are afraid of looking foolish. That’s the whole thing. Not laziness, not indifference — a completely ordinary human reluctance to raise a hand and be wrong in front of colleagues. If a report is met with a delay, a sigh, or a technical explanation of why it was obviously fine, that person will not report again, and neither will anyone they mention it to.

    Three commitments, and they need to be said publicly, not just believed privately.

    Thank people for every report, including the false alarms — especially the false alarms. The reply to a report about a perfectly legitimate email should be warm and short: “Checked it — this one’s genuine, it’s from the insurance broker. Thanks for flagging it, that was exactly the right call.” Never “that was fine.” The thing you’re reinforcing is not accuracy; it’s the act of asking.

    Nobody is ever in trouble for reporting — including reporting their own mistake. This one has to be stated in words, at a staff meeting, by whoever is in charge. “If you click something and then think ‘oh no,’ tell me immediately. You will not be in trouble. The only thing that turns a bad click into a bad month is waiting.” Without that sentence spoken aloud, a scared volunteer will spend four hours hoping it was nothing, and four hours is the difference between a password reset and a wire transfer.

    Answer fast. Not necessarily with an answer — with an acknowledgment. “Got it, looking now” within the hour. A report that vanishes into a mailbox teaches everyone that reporting is pointless, and that lesson sticks harder than any training.

    What to do when one arrives

    You need a short routine, not a procedure manual. Five steps:

    1. Acknowledge it. One line, straight away.

    2. Look at the sender’s actual address, not the display name. The display name is the friendly label your mail app shows — it’s free text and anyone can set it to anything, including your pastor’s name. The real address is what matters, and on a phone it’s usually hidden until you tap it.

    3. Ask whether it wants a credential or wants money. Almost every phishing message wants one of two things: for you to sign in somewhere (a fake login page harvesting your password), or for you to move money, buy gift cards, or change payment details. Naming which one tells you what to do next.

    4. If it’s real, contain it. Ask your mail administrator to search for the same message across all mailboxes and remove it. Whether they can depends on your subscription: in Microsoft 365 it’s done through eDiscovery or Defender for Office 365, and in Google Workspace only the higher editions include the security investigation tool that deletes mail from other people’s inboxes. If your plan can’t, the fallback is telling everyone to delete it — which is step five anyway. If anyone entered a password, that account’s password changes immediately from a different device, active sessions are signed out, multi-factor authentication is checked, and mail rules are reviewed — attackers routinely add a rule to hide their tracks.

    5. Tell everyone. This is the step people skip, and it’s the most valuable one. If a message reached one mailbox, it almost certainly reached several. A two-line note to all staff — “A fake DocuSign email is going around this morning; it’s not from us; delete it” — protects the people who hadn’t opened their email yet.

    That last step is also what makes the next report more likely. People who see that their report produced a visible, useful outcome will report again.

    Speed is the whole game with money

    If a report involves money that has already moved, the clock is the only thing that matters.

    The FBI’s Recovery Asset Team exists to freeze fraudulent transfers, and in 2025 it ran 3,574 domestic incidents and froze $507,042,623. That process works dramatically better inside the first 24 to 72 hours. After that, the money has usually been moved onward and the odds fall off a cliff.

    Which means the value of a reporting culture is not really about email hygiene. It’s that when the bookkeeper realizes at 4:40 on a Friday that the payment she sent this morning went to the wrong account, she picks up the phone immediately instead of sitting with it over the weekend. Everything you do to make reporting comfortable is, in the end, buying hours on that clock.

    For context on scale: business email compromise generated 24,768 complaints in 2025 with reported losses of $3,046,598,558 — an average of about $123,005 per report. Phishing and spoofing, with 191,561 complaints, was the most-reported crime type of the year.

    Attempted or successful fraud goes to the FBI at ic3.gov, and identity theft to identitytheft.gov.

    Measure it gently, or not at all

    If you want a number, use this one: reports per month.

    Not accuracy. Not how many were real. Just how many times somebody raised a hand. A church that goes from zero reports a month to six has built a detection capability it did not have before, and the fact that five of the six were harmless is not a problem — it’s the cost of the sixth.

    Report the number to the board once or twice a year as a positive indicator. “Staff flagged eleven suspicious messages this year; two were real, one of them was an attempted payment change.” That sentence tells a board more about the organization’s actual security posture than any policy document.

    And resist the urge to run a punitive phishing test on your volunteers. If you do simulate one, tell people in advance that it’s coming sometime this quarter, and never publish who clicked. A church is a volunteer organization held together by goodwill; embarrassing a faithful person to make a training point costs more than it teaches.

    What to do this week

    Create the address. Fifteen minutes: a shared mailbox called checkthis@ (or whatever fits your church), pointed at two people, and — if you’re on Microsoft 365 or Google Workspace — confirm the built-in report button is available and that reports land somewhere a human will see them.

    Then, at the next staff meeting, spend two minutes saying the sentence out loud: if anything looks wrong, send it to checkthis@ — you will never be in trouble for asking, and you will never be in trouble for telling me you clicked something.

    CISA’s advice to organizations comes down to the same thing: make sure people know how, and to whom, to report a suspicious message.

    MissionDefend’s free assessment covers exactly this kind of ground — how your organization handles email, donations, member data, and accounts — in plain English, and gives you a baseline score with a ranked list of what to fix first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Configure user reported message settings in Microsoft Defender for Office 365; Google, Avoid and report phishing emails; Cybersecurity and Infrastructure Security Agency, Teach Employees to Avoid Phishing; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Nobody hired you for this.

    You were the office administrator, or the associate pastor, or the one person who was comfortable with computers when the church moved its email over four years ago. The consultant set it up, handed you a login, and left. Since then you’ve added staff accounts, reset a few passwords, and hoped.

    Somewhere in that system are a dozen switches that would meaningfully protect your organization, and nobody ever told you they existed. They’re not hidden. They’re just off, because that’s how they shipped.

    Here are ten of them, in the order I’d do them, with an honest note on each about what it might break. That last part is the bit usually left out — and it’s the reason people abandon this halfway through, when a change nobody warned them about breaks the newsletter on a Friday afternoon.

    A note on menus, and on the word “admin”

    Both platforms redesign their admin console regularly. So this article describes each setting by what it does, not by which menu it’s under. Search the admin console’s own help for the concept name and you’ll find it faster than any screenshot from last year would have taken you.

    And to be plain about the word: an administrator account is the login that can create and delete other people’s accounts, read their mail, and change any setting here. In most churches, one or two people have that power and don’t think of themselves as having it. If your everyday account is also the administrator account, every phishing email you receive is aimed at the keys to the whole building.

    Start here: the two that carry the whole afternoon

    1. Multi-factor authentication for every single person. Multi-factor authentication — MFA, or 2-Step Verification in Google’s language — is the extra step after your password: a prompt on your phone, a code, a tap. Microsoft’s own research puts it at blocking more than 99.2% of account compromise attacks. Everything else in this article is a rounding error next to it.

    Do the administrator account first, and carefully. Microsoft now requires MFA to sign in to its admin portals at all, having rolled that out through 2024 and 2025, so this may already be forced on you. Set it up while you are sitting at a computer you control, with the phone in your hand, and confirm you can sign out and back in again before you touch anyone else’s account.

    Time: fifteen minutes for the admin account, then a few minutes per person.
    What it might break: older mail apps and desk devices that only know how to send a password — a copier that scans to email, a legacy accounting tool, a spouse’s ancient phone mail app. Make a list of those before you enforce it organization-wide, because they will fail silently and you’ll spend an afternoon chasing why the scanner stopped working.

    2. A second administrator account, so one lost phone doesn’t lock everyone out. This is the step people skip, and it’s the one that produces the worst days. If exactly one person is the administrator and their phone goes in a lake, nobody can add a staff member, reset a password, or recover a mailbox until a support process that takes days is finished.

    Create a second administrator account. Give it to a second trusted person, or keep it as a rarely-used emergency account with its credentials sealed in the safe where the church keeps its other important documents. Note that Microsoft requires MFA on emergency accounts too and suggests a passkey or a certificate rather than a phone, precisely so the emergency account doesn’t depend on the same phone as everything else.

    Time: ten minutes.
    What it might break: nothing — but a forgotten emergency account with a stale password is worse than none, because you’ll rely on it. Sign into it once a quarter.

    Mail: make impersonation and quiet theft harder

    3. Warning banners on mail from outside the organization. Both platforms can mark messages that came from outside your own domain, so a note claiming to be from your senior pastor visibly isn’t. Microsoft calls this external sender identification; it’s an organization-wide setting an administrator controls, and in most tenants it has to be switched on rather than being on already — check yours rather than assuming either way. Google has equivalent external-sender warnings.

    This is the cheapest defence there is against display-name impersonation — the trick where an attacker sets the friendly name on their account to “Pastor Dave” and your phone shows only that name.

    Time: ten minutes, though on Microsoft the tag can take a day or two to start appearing.
    What it might break: very little, but expect confusion in week one. Tell staff in advance, and tell them what the banner means: not this is dangerous, but this did not come from inside our organization. Some legitimate senders — your denominational office, a mailing service you use — will be tagged, and that’s correct behaviour.

    4. Block or alert on automatic forwarding to outside addresses. This is how theft goes unnoticed. An attacker who gets into a mailbox often sets a rule that quietly copies every message to an address they control, then leaves. They may never send anything from your account at all; they simply read your mail for months, learn your vendors and your payment cycle, and strike once.

    On Microsoft, automatic external forwarding is now blocked by default under the outbound spam policy — but confirm it, because a previous administrator or consultant may have switched it on. Google has an administrator setting that removes the automatic forwarding option from users entirely.

    Time: ten minutes.
    What it might break: real forwards people rely on. The retiring treasurer forwarding church mail to a personal address. A shared role account feeding someone’s personal inbox. Under Microsoft’s block, those messages bounce back to the sender with a message about external forwarding not being allowed — which is confusing if you weren’t expecting it. Find the legitimate forwards first, replace them with a proper shared mailbox or a group, then turn the block on.

    5. Audit the mail rules that already exist. Blocking new forwarding doesn’t remove what’s already there. In each staff mailbox — especially anyone who touches money — look at the rules and filters. You’re looking for anything the person doesn’t remember creating, and in particular for rules that file messages containing words like invoice, payroll, deposit, or bank into an unread folder or straight into deleted items. That’s a rule an attacker writes so the victim never sees the confirmation of what’s being done in their name.

    Time: five minutes per mailbox, and worth doing for everyone once.
    What it might break: nothing, if you ask before you delete. Some people have genuinely elaborate filing rules. Ask, don’t assume.

    Apps and evidence

    6. Review which third-party apps have been granted access. Over the years, staff have clicked “Allow” on things — a scheduling tool, a PDF signer, a survey app, something that promised to make Sunday easier. Each grant can carry standing permission to read mail or files, and it survives a password change. It also survives the departure of the person who granted it, and the closure of the company that built it.

    Both platforms list these. Microsoft shows the applications with permissions in your tenant; Google’s app access control lets you see connected apps and mark them trusted, limited, or blocked. Look for anything you don’t recognize or no longer use, and remove it.

    Time: twenty minutes, and genuinely interesting the first time.
    What it might break: a tool someone actively uses. Revoke, then tell people to speak up if something stops working — that’s a faster route to an accurate inventory than trying to research each one.

    7. Turn on audit logging before you need it. Audit logs record who signed in, from where, what they changed, what they downloaded. You will not care about this until the morning you need to answer “what exactly did they get into?” — and at that point, if logging was off, the answer is permanently unavailable. There is no way to go back and collect it.

    Here’s a detail worth knowing: Microsoft turns auditing on by default for most organizations, but not for the small-business licenses most churches actually hold — Business Basic, Business Standard, and Business Premium. On those, an administrator has to enable it. Once on, activity is retained for 180 days by default. Google Workspace keeps admin and login audit logs available in the admin console.

    Time: ten minutes.
    What it might break: nothing at all. This is the purest cost-free item on the list.

    Files and accounts

    8. Fix the sharing defaults on the shared drive. Both platforms let you choose what happens by default when someone shares a file: a link anyone on the internet can open, a link anyone inside the organization can open, or access granted to named people only. Many organizations are still on a permissive default, which means well-meaning staff have been generating public links for years without realizing it — for budgets, board minutes, and membership lists.

    Change the default so sharing requires naming a person. Then spend ten minutes looking at what is currently shared broadly.

    Time: thirty minutes including the review.
    What it might break: this is the item most likely to cause friction. Volunteers who open a bulletin template through a link may lose access. Anything you publish deliberately — a public calendar, a sermon archive — needs to be re-shared correctly. Do this one on a Monday, not a Saturday.

    9. Remove dormant accounts. The youth intern from two summers ago. The bookkeeper who left in 2021. The volunteer who set up your website and hasn’t been seen since. Each is a live door with a password that has never been changed and no MFA on it.

    Don’t delete immediately — on both platforms, deleting a user can take their files and mail with them. Suspend or block sign-in first, keep the account for a defined period, tell anyone who might need something from it, then remove it.

    Time: twenty minutes.
    What it might break: access to files owned by that person that other people still use. That’s exactly why you suspend before you delete.

    10. Know where “sign out everywhere” is — before the emergency. Changing a password does not always eject someone who is already signed in; active sessions can persist. Both platforms have a control that terminates every session for a user and forces a fresh sign-in — Microsoft describes it as revoking sessions, Google as signing the user out and resetting sign-in cookies.

    You are not turning anything on here. You are finding the button now, while it’s calm, and writing down where it is. The day you need it, you’ll need it in the next ninety seconds.

    Time: five minutes.
    What it might break: when used, it signs that person out of everything and they’ll have to log back in. That’s the point.

    What to do this week

    Block out ninety minutes and do items one and two: multi-factor authentication on the administrator account, done carefully, and a second administrator account created and written down where the church keeps its important papers.

    Then turn on audit logging, because it takes ten minutes, costs nothing, breaks nothing, and can only be done in advance.

    That’s the honest scope of this article: it’s an afternoon, not a project. And the first item alone is most of the benefit — if you only ever get one thing done, get MFA on every account and treat the rest as a bonus.

    MissionDefend’s free assessment covers exactly this ground in plain English — how your email, donations, member data and accounts are actually set up — and hands back a ranked list, so you know which of these ten to spend your one available afternoon on.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, mandatory multifactor authentication guidance; Microsoft, Set-ExternalInOutlook (external sender identification); Microsoft, manage emergency access admin accounts; Microsoft, configure external email forwarding controls; Microsoft, turn auditing on or off; Microsoft, revoke user access in an emergency; Microsoft, manage sharing settings for SharePoint and OneDrive; Google, protect your organization with 2-Step Verification; Google, let users automatically forward their own Gmail; Google, control which apps access Google Workspace data; Google, manage external sharing for your organization; Google, administrator privilege definitions.

  • Anatomy of a Phishing Email: Eight Tells and What They Look Like

    Anatomy of a Phishing Email: Eight Tells and What They Look Like

    Phishing — the fake email built to make you click, log in, or pay — was the most-reported cybercrime in America again in 2025: 191,561 complaints to the FBI’s Internet Crime Complaint Center, more than any other category. It holds that title year after year for a boring reason: it keeps working.

    It keeps working partly because the training most people got is out of date. The old advice was “look for bad grammar and obvious typos.” CISA — the federal cybersecurity agency — now says plainly that generative AI has made well-written phishing routine. The clumsy Nigerian-prince era is over; the fakes are fluent now.

    What hasn’t changed is the structure. A phishing email has a job to do — create trust, create pressure, deliver a click — and the machinery for doing that job leaves the same fingerprints it always has. Here are eight of them, each shown the way it actually lands in a church office inbox. The examples are composites, not real messages, but every pattern in them is drawn from the attacks this series has already decoded.

    1. The display name that doesn’t match the address

    From: Pastor David Reeves ‹pastordavid.stmarks@gmail‑mail‑secure.com›
    Are you available? I need a favor handled discreetly.

    Email lets anyone put any name in the “From” line — the display name is decoration, chosen by the sender. The tell is the actual address behind it. On a phone, that address is hidden by default, which is exactly why so much phishing succeeds on phones: tap the sender’s name and read the real address before you believe anything else about the message. Your pastor’s real address you know. Everything else is a costume.

    2. Urgency with a deadline measured in hours

    Your mailbox will be deactivated in 4 hours. Verify now to avoid interruption.

    Legitimate organizations almost never need you to act within the hour, because nothing real works that way. Manufactured deadlines exist to keep you from doing the one thing that kills every scam: pausing to check. CISA lists urgent, consequence-laden language as the leading sign of phishing. When an email makes your chest tighten, that feeling is the payload.

    3. The mismatched link

    www.churchgivingportal.com/login

    The words of a link and its destination are two separate things — the blue text can say anything while pointing anywhere. On a computer, hover over the link without clicking and read the true address in the corner of the window. On a phone, press and hold to preview it. Watch for near-misses built to survive a glance: `rnicrosoft.com` (r-n masquerading as m), `yourchurch-give.com` instead of `yourchurch.org/give`, or a real brand name buried in front of an unrelated domain: `microsoft.security-check-portal.com`. The only part that matters is the last two pieces before the first slash.

    4. The login page you didn’t navigate to

    Your document is ready: OfferingReport_Q2.pdf — Sign in to view.

    The fake login page is where credentials actually get stolen. The email is just the ride there. The rule that beats it: a link you clicked in an email never gets a password. If a message says a document, invoice or voicemail is waiting behind a sign-in, close it and go to the service directly — type the address or use the app. If the document is real, it’s there. This habit also defeats attacks good enough to beat inspection, which some now are.

    5. A request that switches channels or demands secrecy

    Don’t call me, I’m going into the service. Just reply here.

    Real requests survive verification; fake ones must prevent it. So the message forbids exactly the act that would expose it — “don’t call,” “keep this between us,” “I’m unreachable.” We’ve seen this lever in the gift card scam, in payroll diversion, and in voice cloning. Treat any instruction not to verify as the confession it is.

    6. The attachment that needs something extra

    Invoice attached. If the document appears blank, click Enable Content to view.

    An attachment that requires you to click a button, enable macros, or install “a viewer” to read it isn’t a document with a problem — it’s a program wearing a document’s clothes. Modern office software disables that machinery by default precisely because it was the most common way malware got run. The email is asking you to overrule your own safety equipment.

    7. The reply-to that goes somewhere else

    From: finance@yourdenomination.org
    Reply-To: finance.office.desk@outlook.com

    Some phishing genuinely spoofs a trusted address in the “From” line — but the conversation has to route back to the attacker, and the hidden Reply-To field is where that happens. If you hit reply and the address in the compose window isn’t the one you thought you were talking to, stop. This is also why continuing an email thread is not verification: in business email compromise, the thread itself is the stolen property.

    8. Almost right, at the wrong moment

    Following up on the invoice from last month’s roof repair — updated remittance details attached.

    The most dangerous phishing contains no visible mistakes, because it’s built from real information: your actual roofer, a real project, plausible timing. The tell isn’t in the text — it’s in the event: money or credentials being requested with any change from the established pattern (new bank details, new payment method, new address, unusual quiet urgency). At that point the email’s quality is irrelevant, because your procedure — confirm changes by phone on a number you already have — doesn’t care how good the writing is.

    What to do this week

    Print these eight, tape them by the office computer, and spend ten minutes at the next staff meeting reading the examples aloud — people recognize patterns far faster from specimens than from rules. Then set the reporting habit: CISA’s guidance is recognize, resist, delete — and in an organization, “resist” means report it to whoever handles your email before deleting, so one alert reader protects everyone. Make the report thank-worthy, never eye-roll-worthy; the person who forwards a false alarm is your early-warning system working.

    And keep the fallback that underlies this whole series: when an email requests money, credentials, or account changes, the email itself is never the proof. Verification travels on a different channel — a phone number you already had, an address you typed yourself.

    The MissionDefend assessment checks whether your organization has these habits in place — reporting culture, verification rules, MFA — and gives you a prioritized plan for what’s missing. Join the launch list.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report (phishing/spoofing complaint count); Cybersecurity and Infrastructure Security Agency, Recognize and Report Phishing.